Cybersecurity experts have recently revealed a critical vulnerability in the Adobe Acrobat extension for Chrome, which, prior to being patched, posed a significant risk to WhatsApp Web data for its 314 million users. This vulnerability, named HermeticReader by Guardio Labs, had the potential to enable silent data hijacking if exploited.
Understanding HermeticReader
Officially identified as CVE-2026-48294 and carrying a CVSS score of 7.4, the flaw is characterized as a universal cross-site scripting (UXSS)-class cross-origin data disclosure vulnerability. It affected all versions of the extension up to version 26.5.2.2 and allowed bypassing of the browser’s same-origin policy, accessing session-related data across different origins.
Exploitation required user interaction, specifically convincing a user to visit a malicious URL or interact with a compromised web page. This setup allowed attackers to gain access to sensitive data from third-party web applications loaded in the victim’s browser, including WhatsApp Web.
Mechanism of the Attack
The attack involved an attacker-controlled page crafted to resemble legitimate search results or marketing emails. When a victim with the Adobe Acrobat extension installed visits this page, it activates a dormant engine in the extension, targeting WhatsApp Web data.
According to Guardio Labs researcher Shaked Biner, the attack sequence involved an iframe element loading from extension resources, altering settings to activate the Hermes engine. This engine manipulated WhatsApp Web by injecting a POST form into its DOM, effectively extracting WhatsApp data.
Notably, the flaw required no additional malware installation, credential phishing, or session cookie extraction. Simply visiting the crafted page sufficed for the attack.
Implications and Industry Response
The flaw highlighted vulnerabilities at a fundamental level, with Guardio Labs emphasizing the industry’s focus on dramatic exploit classes, often neglecting ‘plumbing-level’ flaws. Such vulnerabilities can lead to significant security breaches, especially with large install bases remaining unchecked for extended periods.
In conclusion, while this specific vulnerability has been patched, it underscores the importance of continuous vigilance and prompt response to potential security threats. Users are advised to regularly update their software and remain cautious of unfamiliar web pages to safeguard their data.
